Windbg---HEAP CORRUPTION

1.设置gflags

2.attach to xxx.exe
3.出现异常时，生成dump     .dump /ma c:\xxx.dmp
4.分析dump

0:013> !analyze -v

FAULTING_IP:
ntdll!RtlpAllocateHeap+e83
00000000`77413fcf 4d8b4b08        mov     r9,qword ptr [r11+8]

EXCEPTION_RECORD:  ffffffffffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 0000000077413fcf (ntdll!RtlpAllocateHeap+0x0000000000000e83)
   ExceptionCode: c0000005 (Access violation)
  ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 0000000000000000
   Parameter[1]: ffffffffffffffff
Attempt to read from address ffffffffffffffff

PROCESS_NAME:  svchost.exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at "0x%08lx" referenced memory at "0x%08lx". The memory could not be "%s".

EXCEPTION_PARAMETER1:  0000000000000000

EXCEPTION_PARAMETER2:  ffffffffffffffff

READ_ADDRESS:  ffffffffffffffff

FOLLOWUP_IP:
DHCPDLL!operator new+1f [f:\dd\vctools\crt_bld\self_64_amd64\crt\src\new.cpp @ 59]
00000000`745c4faf 4885c0          test    rax,rax

NTGLOBALFLAG:  0

APPLICATION_VERIFIER_FLAGS:  0

LAST_CONTROL_TRANSFER:  from 0000000000000000 to 00000000774879d8

FAULTING_THREAD:  ffffffffffffffff

DEFAULT_BUCKET_ID:  STATUS_ACCESS_VIOLATION

PRIMARY_PROBLEM_CLASS:  STATUS_ACCESS_VIOLATION

BUGCHECK_STR:  APPLICATION_FAULT_STATUS_ACCESS_VIOLATION

STACK_TEXT: 
00000000`774879d8 ntdll!RtlpAnalyzeHeapFailure
00000000`7741fa23 ntdll!RtlpAllocateHeap
00000000`77413518 ntdll!RtlAllocateHeap
00000000`745c14c3 DHCPDLL!malloc
00000000`745c4faf DHCPDLL!operator new
00000000`745cd39f DHCPDLL!DhcpDllNewPktHook
000007fe`f51ed5e7 dhcpssvc!ProcessReceivedPacket
00000000`772b652d kernel32!BaseThreadInitThunk
00000000`773ec521 ntdll!RtlUserThreadStart

FAULTING_SOURCE_CODE: 
No source found for 'f:\dd\vctools\crt_bld\self_64_amd64\crt\src\new.cpp'

SYMBOL_STACK_INDEX:  4

SYMBOL_NAME:  DHCPDLL!operator new+1f

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: DHCPDLL

IMAGE_NAME:  DHCPDLL.dll

DEBUG_FLR_IMAGE_TIMESTAMP:  5350b42c

STACK_COMMAND:  !heap ; dds 774fb4b8 ; kb

FAILURE_BUCKET_ID:  STATUS_ACCESS_VIOLATION_c0000005_DHCPDLL.dll!operator new

BUCKET_ID:  X64_APPLICATION_FAULT_STATUS_ACCESS_VIOLATION_DHCPDLL!operator_new+1f

Followup: MachineOwner
---------
//列出当前进程的所有堆
0:013> !heap -p

    No GlobalFlag bits active for this process
    active heaps:

 - 250000
          HEAP_GROWABLE
 - 10000
          HEAP_CLASS_8
 - 4b0000
          HEAP_GROWABLE HEAP_CLASS_1
 - 1310000
          HEAP_GROWABLE HEAP_CLASS_1
 - 4a0000
          HEAP_GROWABLE HEAP_CLASS_1
 - 1530000
          HEAP_GROWABLE HEAP_CLASS_1
 - 5de0000
          HEAP_GROWABLE HEAP_CLASS_1
 - 62e0000
          HEAP_GROWABLE HEAP_CLASS_1
//查看堆5de0000的内存分配情况
0:013> !heap -p -h 5de0000
    _HEAP @ 5de0000
      No FrontEnd
      _HEAP_SEGMENT @ 5de0000
       CommittedRange @ 5de0a80
              HEAP_ENTRY Size Prev Flags            UserPtr UserSize - state
      * 0000000005de0a80 0086 0000  [00]   0000000005de0a90    00850 - (busy)
        0000000005de12e0 002d 0086  [00]   0000000005de12f0    002c8 - (busy)
        0000000005de15b0 0011 002d  [00]   0000000005de15c0    00100 - (busy)
        0000000005de16c0 0002 0011  [00]   0000000005de16d0    00001 - (busy)
        0000000005de16e0 0002 0002  [00]   0000000005de16f0    00001 - (busy)
        0000000005de1700 0003 0002  [00]   0000000005de1710    00020 - (free)
        0000000005de1730 0002 0003  [00]   0000000005de1740    00008 - (busy)
        0000000005de1750 002d 0002  [00]   0000000005de1760    002c8 - (busy)
        0000000005de1a20 000d 002d  [00]   0000000005de1a30    000c0 - (free)
        0000000005de1af0 00b1 000d  [00]   0000000005de1b00    00b00 - (busy)
        0000000005de2600 0023 00b1  [00]   0000000005de2610    00220 - (busy)
        0000000005de2830 0006 0023  [00]   0000000005de2840    0004e - (busy)
        0000000005de2890 0012 0006  [00]   0000000005de28a0    00110 - (busy)
        0000000005de29b0 0003 0012  [00]   0000000005de29c0    0001f - (busy)
        0000000005de29e0 0005 0003  [00]   0000000005de29f0    00042 - (busy)
        0000000005de2a30 0004 0005  [00]   0000000005de2a40    00031 - (busy)
        0000000005de2a70 0005 0004  [00]   0000000005de2a80    0003c - (busy)
        0000000005de2ac0 0004 0005  [00]   0000000005de2ad0    00031 - (busy)
        0000000005de2b00 0003 0004  [00]   0000000005de2b10    0001d - (busy)
        0000000005de2b30 0003 0003  [00]   0000000005de2b40    00024 - (busy)
        0000000005de2b60 0002 0003  [00]   0000000005de2b70    00014 - (busy)
        0000000005de2b80 0005 0002  [00]   0000000005de2b90    00045 - (busy)
        0000000005de2bd0 0002 0005  [00]   0000000005de2be0    00017 - (busy)
        0000000005de2bf0 0002 0002  [00]   0000000005de2c00    0000e - (busy)
        0000000005de2c10 0008 0002  [00]   0000000005de2c20    00069 - (busy)
        0000000005de2c90 0005 0008  [00]   0000000005de2ca0    0003e - (busy)
        0000000005de2ce0 0003 0005  [00]   0000000005de2cf0    0001d - (busy)
        0000000005de2d10 0005 0003  [00]   0000000005de2d20    00048 - (busy)
        0000000005de2d60 0002 0005  [00]   0000000005de2d70    00012 - (busy)
        0000000005de2d80 0002 0002  [00]   0000000005de2d90    00018 - (busy)
        0000000005de2da0 0003 0002  [00]   0000000005de2db0    0001b - (busy)
        0000000005de2dd0 0003 0003  [00]   0000000005de2de0    0001e - (busy)
        0000000005de2e00 0004 0003  [00]   0000000005de2e10    00029 - (busy)
        0000000005de2e40 0003 0004  [00]   0000000005de2e50    0001e - (busy)
        0000000005de2e70 0005 0003  [00]   0000000005de2e80    00041 - (busy)
        0000000005de2ec0 0002 0005  [00]   0000000005de2ed0    00017 - (busy)
        0000000005de2ee0 0002 0002  [00]   0000000005de2ef0    0000f - (busy)
        0000000005de2f00 0002 0002  [00]   0000000005de2f10    00016 - (busy)
        0000000005de2f20 0004 0002  [00]   0000000005de2f30    00035 - (busy)
        0000000005de2f60 0004 0004  [00]   0000000005de2f70    00034 - (busy)
        0000000005de2fa0 0002 0004  [00]   0000000005de2fb0    00012 - (busy)
        0000000005de2fc0 0003 0002  [00]   0000000005de2fd0    0001a - (busy)
        0000000005de2ff0 0004 0003  [00]   0000000005de3000    00036 - (busy)
        0000000005de3030 0002 0004  [00]   0000000005de3040    00012 - (busy)
        0000000005de3050 0002 0002  [00]   0000000005de3060    00018 - (busy)
        0000000005de3070 0005 0002  [00]   0000000005de3080    00046 - (busy)
        0000000005de30c0 0101 0005  [00]   0000000005de30d0    01000 - (busy)
          DHCPDLL!_iob
        0000000005de40d0 002d 0101  [00]   0000000005de40e0    002c8 - (busy)
        0000000005de43a0 002d 002d  [00]   0000000005de43b0    002c8 - (busy)
        0000000005de4670 002d 002d  [00]   0000000005de4680    002c8 - (busy)
        0000000005de4940 002d 002d  [00]   0000000005de4950    002c8 - (busy)
        0000000005de4c10 002d 002d  [00]   0000000005de4c20    002c8 - (busy)
        0000000005de4ee0 002d 002d  [00]   0000000005de4ef0    002c8 - (busy)
        0000000005de51b0 002d 002d  [00]   0000000005de51c0    002c8 - (busy)
        0000000005de5480 002d 002d  [00]   0000000005de5490    002c8 - (busy)
        0000000005de5750 038b 002d  [00]   0000000005de5760    038a8 - (busy)
//堆越界
ReadMemory error for address 0000000005de9000
Use `!address 0000000005de9000' to check validity of the address.
0:013> !heap -p -a 0000000005de9000
c0000005 Exception in ext.heap debugger extension.
      PC: 00000000`01c2917e  VA: 00000000`00000030  R/W: 0  Parameter: 00000000`0001003f
0:013> r
rax=006f004400200020 rbx=0000000005de0000 rcx=0000000005de0208
rdx=0000000005de5fd0 rsi=0000000001003828 rdi=0000000005de5fc0
rip=0000000077413fcf rsp=000000000a20f250 rbp=0000000000000000
 r8=000000000000014a  r9=0000000000000160 r10=0000000000000000
r11=ad5650000000014b r12=0000000000000004 r13=0000000000000016
r14=0000000000000002 r15=00000000774d5401
iopl=0         nv up ei pl zr na po nc
cs=0033  ss=002b  ds=002b  es=002b  fs=0053  gs=002b             efl=00010246
ntdll!RtlpAllocateHeap+0xe83:
00000000`77413fcf 4d8b4b08        mov     r9,qword ptr [r11+8] ds:ad565000`00000153=????????????????